如何在 Azure 中创建具有多个网络接口卡的 Linux 虚拟机How to create a Linux virtual machine in Azure with multiple network interface cards

本文详述了如何使用 Azure CLI 创建具有多个 NIC 的 VM。This article details how to create a VM with multiple NICs with the Azure CLI.

创建支持资源Create supporting resources

安装最新的 Azure CLI 并使用 az login 登录到 Azure 帐户。Install the latest Azure CLI and log in to an Azure account using az login.

备注

在 Azure China 中使用 Azure CLI 2.0 之前,请首先运行 az cloud set -n AzureChinaCloud 更改云环境。Before you can use Azure CLI 2.0 in Azure China, please run az cloud set -n AzureChinaCloud first to change the cloud environment. 如果要切换回全局 Azure,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Global Azure, run az cloud set -n AzureCloud again.

在以下示例中,请将示例参数名称替换成自己的值。In the following examples, replace example parameter names with your own values. 示例参数名称包括 myResourceGroup**、mystorageaccount** 和 myVM**。Example parameter names included myResourceGroup, mystorageaccount, and myVM.

首先,使用 az group create 创建资源组。First, create a resource group with az group create. 以下示例在“chinaeast” 位置创建名为“myResourceGroup” 的资源组:The following example creates a resource group named myResourceGroup in the chinaeast location:

az group create --name myResourceGroup --location chinaeast

使用 az network vnet create 创建虚拟网络。Create the virtual network with az network vnet create. 以下示例创建一个名为 myVnet** 的虚拟网络和一个名为 mySubnetFrontEnd** 的子网:The following example creates a virtual network named myVnet and subnet named mySubnetFrontEnd:

az network vnet create \
    --resource-group myResourceGroup \
    --name myVnet \
    --address-prefix 10.0.0.0/16 \
    --subnet-name mySubnetFrontEnd \
    --subnet-prefix 10.0.1.0/24

使用 az network vnet subnet create 为后端通信流创建子网。Create a subnet for the back-end traffic with az network vnet subnet create. 以下示例创建名为 mySubnetBackEnd** 的子网:The following example creates a subnet named mySubnetBackEnd:

az network vnet subnet create \
    --resource-group myResourceGroup \
    --vnet-name myVnet \
    --name mySubnetBackEnd \
    --address-prefix 10.0.2.0/24

使用 az network nsg create 创建网络安全组。Create a network security group with az network nsg create. 以下示例创建名为“myNetworkSecurityGroup”** 的网络安全组:The following example creates a network security group named myNetworkSecurityGroup:

az network nsg create \
    --resource-group myResourceGroup \
    --name myNetworkSecurityGroup

创建和配置多个 NICCreate and configure multiple NICs

使用 az network nic create 创建两个 NIC。Create two NICs with az network nic create. 以下示例创建两个连接到网络安全组的 NIC(名为 myNic1** 和 myNic2**),其中一个 NIC 连接到每个子网:The following example creates two NICs, named myNic1 and myNic2, connected the network security group, with one NIC connecting to each subnet:

az network nic create \
    --resource-group myResourceGroup \
    --name myNic1 \
    --vnet-name myVnet \
    --subnet mySubnetFrontEnd \
    --network-security-group myNetworkSecurityGroup
az network nic create \
    --resource-group myResourceGroup \
    --name myNic2 \
    --vnet-name myVnet \
    --subnet mySubnetBackEnd \
    --network-security-group myNetworkSecurityGroup

创建 VM 并附加 NICCreate a VM and attach the NICs

创建 VM 时,指定使用 --nics 创建的 NIC。When you create the VM, specify the NICs you created with --nics. 还需要谨慎选择 VM 的大小。You also need to take care when you select the VM size. 可添加到 VM 的 NIC 数目有限制。There are limits for the total number of NICs that you can add to a VM. 详细了解 Linux VM 大小Read more about Linux VM sizes.

使用 az vm create 创建 VM。Create a VM with az vm create. 以下示例创建一个名为 myVM 的 VM:The following example creates a VM named myVM:

az vm create \
    --resource-group myResourceGroup \
    --name myVM \
    --image UbuntuLTS \
    --size Standard_DS3_v2 \
    --admin-username azureuser \
    --generate-ssh-keys \
    --nics myNic1 myNic2

通过完成为多个 NIC 配置来宾 OS 中的步骤,将路由表添加到来宾 OS。Add routing tables to the guest OS by completing the steps in Configure the guest OS for multiple NICs.

将 NIC 添加到 VMAdd a NIC to a VM

之前的步骤创建了具有多个 NIC 的 VM。The previous steps created a VM with multiple NICs. 还可使用 Azure CLI 将 NIC 添加到现有 VM。You can also add NICs to an existing VM with the Azure CLI. 不同的 VM 大小支持不同数目的 NIC,因此请相应地调整 VM 的大小。Different VM sizes support a varying number of NICs, so size your VM accordingly. 如果需要,可调整 VM 的大小If needed, you can resize a VM.

使用 az network nic create 创建另一 NIC。Create another NIC with az network nic create. 以下示例创建一个名为 myNic3** 的 NIC,该 NIC 连接到后端子网和之前步骤中创建的网络安全组:The following example creates a NIC named myNic3 connected to the back-end subnet and network security group created in the previous steps:

az network nic create \
    --resource-group myResourceGroup \
    --name myNic3 \
    --vnet-name myVnet \
    --subnet mySubnetBackEnd \
    --network-security-group myNetworkSecurityGroup

要将 NIC 添加到现有 VM,请先使用 az vm deallocate 解除分配 VM。To add a NIC to an existing VM, first deallocate the VM with az vm deallocate. 以下示例解除分配名为 myVM** 的 VM :The following example deallocates the VM named myVM:

az vm deallocate --resource-group myResourceGroup --name myVM

使用 az vm nic add 添加 NIC。Add the NIC with az vm nic add. 以下示例将 myNic3** 添加到 myVM**:The following example adds myNic3 to myVM:

az vm nic add \
    --resource-group myResourceGroup \
    --vm-name myVM \
    --nics myNic3

使用 az vm start 启动 VM:Start the VM with az vm start:

az vm start --resource-group myResourceGroup --name myVM

通过完成为多个 NIC 配置来宾 OS 中的步骤,将路由表添加到来宾 OS。Add routing tables to the guest OS by completing the steps in Configure the guest OS for multiple NICs.

从 VM 中删除 NICRemove a NIC from a VM

若要从现有 VM 删除 NIC,请先使用 az vm deallocate 解除分配 VM。To remove a NIC from an existing VM, first deallocate the VM with az vm deallocate. 以下示例解除分配名为 myVM** 的 VM :The following example deallocates the VM named myVM:

az vm deallocate --resource-group myResourceGroup --name myVM

使用 az vm nic remove 删除 NIC。Remove the NIC with az vm nic remove. 以下示例从 myVM** 删除 myNic3**:The following example removes myNic3 from myVM:

az vm nic remove \
    --resource-group myResourceGroup \
    --vm-name myVM \
    --nics myNic3

使用 az vm start 启动 VM:Start the VM with az vm start:

az vm start --resource-group myResourceGroup --name myVM

使用 Resource Manager 模板创建多个 NICCreate multiple NICs using Resource Manager templates

Azure 资源管理器模板使用声明性 JSON 文件来定义环境。Azure Resource Manager templates use declarative JSON files to define your environment. 可以阅读 Azure 资源管理器概述You can read an overview of Azure Resource Manager. 资源管理器模板可让你在部署期间创建资源的多个实例,例如,创建多个 NIC。Resource Manager templates provide a way to create multiple instances of a resource during deployment, such as creating multiple NICs. 使用 copy 指定要创建的实例数:You use copy to specify the number of instances to create:

"copy": {
    "name": "multiplenics"
    "count": "[parameters('count')]"
}

阅读有关使用 copy 创建多个实例的详细信息。Read more about creating multiple instances using copy.

也可以使用 copyIndex() 并在资源名称中追加一个数字,来创建 myNic1myNic2,等等。下面显示了追加索引值的示例:You can also use a copyIndex() to then append a number to a resource name, which allows you to create myNic1, myNic2, etc. The following shows an example of appending the index value:

"name": "[concat('myNic', copyIndex())]", 

可以阅读使用 Resource Manager 模板创建多个 NIC 的完整示例。You can read a complete example of creating multiple NICs using Resource Manager templates.

通过完成为多个 NIC 配置来宾 OS 中的步骤,将路由表添加到来宾 OS。Add routing tables to the guest OS by completing the steps in Configure the guest OS for multiple NICs.

为多个 NIC 配置来宾 OSConfigure guest OS for multiple NICs

前面的步骤创建了虚拟网络和子网,附加了 NIC,然后创建了 VM。The previous steps created a virtual network and subnet, attached NICs, then created a VM. 尚未创建公共 IP 地址,以及允许 SSH 流量的网络安全组规则。A public IP address and network security group rules that allow SSH traffic were not created. 若要为多个 NIC 配置来宾 OS,需要允许远程连接并在 VM 本地运行命令。To configure the guest OS for multiple NICs, you need to allow remote connections and run commands locally on the VM.

若要允许 SSH 流量,请使用 az network nsg rule create 创建网络安全组规则,如下所示:To allow SSH traffic, create a network security group rule with az network nsg rule create as follows:

az network nsg rule create \
    --resource-group myResourceGroup \
    --nsg-name myNetworkSecurityGroup \
    --name allow_ssh \
    --priority 101 \
    --destination-port-ranges 22

使用 az network public-ip create 创建公共 IP 地址,并使用 az network nic ip-config update 将其分配到第一个 NIC:Create a public IP address with az network public-ip create and assign it to the first NIC with az network nic ip-config update:

az network public-ip create --resource-group myResourceGroup --name myPublicIP

az network nic ip-config update \
    --resource-group myResourceGroup \
    --nic-name myNic1 \
    --name ipconfig1 \
    --public-ip-address myPublicIP

若要查看 VM 的公共 IP 地址,请使用 az vm show,如下所示:To view the public IP address of the VM, use az vm show as follows::

az vm show --resource-group myResourceGroup --name myVM -d --query publicIps -o tsv

现在,通过 SSH 连接到 VM 的公共 IP 地址。Now SSH to the public IP address of your VM. 上一步骤中提供的默认用户名为 azureuserThe default username provided in a previous step was azureuser. 请提供自己的用户名和公共 IP 地址:Provide your own username and public IP address:

ssh azureuser@137.117.58.232

若要向/从辅助网络接口发送数据,必须手动将永久性路由添加到每个辅助网络接口的操作系统。To send to or from a secondary network interface, you have to manually add persistent routes to the operating system for each secondary network interface. 在本文中,eth1 是辅助接口。In this article, eth1 is the secondary interface. 有关将永久性路由添加到操作系统的说明根据分发版的不同而异。Instructions for adding persistent routes to the operating system vary by distro. 请参阅分发版的文档来获取说明。See documentation for your distro for instructions.

将路由添加到操作系统时,网络接口所在的每个子网的网关地址为 .1When adding the route to the operating system, the gateway address is .1 for whichever subnet the network interface is in. 例如,如果为网络接口分配了地址 10.0.2.4,则为路由指定的网关就是 10.0.2.1For example, if the network interface is assigned the address 10.0.2.4, the gateway you specify for the route is 10.0.2.1. 如果希望接口的所有流量通过指定的网关,可为路由目标定义特定的网络,或指定目标 0.0.0.0You can define a specific network for the route's destination, or specify a destination of 0.0.0.0, if you want all traffic for the interface to go through the specified gateway. 每个子网的网关由虚拟网络管理。The gateway for each subnet is managed by the virtual network.

添加辅助接口的路由后,使用 route -n 验证该路由是否包含在路由表中。Once you've added the route for a secondary interface, verify that the route is in your route table with route -n. 以下示例输出适用于其中的两个网络接口已添加到本文所述 VM 的路由表:The following example output is for the route table that has the two network interfaces added to the VM in this article:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.1.1        0.0.0.0         UG    0      0        0 eth0
0.0.0.0         10.0.2.1        0.0.0.0         UG    0      0        0 eth1
10.0.1.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 eth1
168.63.129.16   10.0.1.1        255.255.255.255 UGH   0      0        0 eth0
169.254.169.254 10.0.1.1        255.255.255.255 UGH   0      0        0 eth0

重新启动后请再次检查路由表,以确认每次重新启动后,添加的路由是否能够保留。Confirm that the route you added persists across reboots by checking your route table again after a reboot. 若要测试连接,可输入以下示例所示的命令,其中,eth1 是辅助网络接口的名称:To test connectivity, you can enter the following command, for example, where eth1 is the name of a secondary network interface:

ping bing.com -c 4 -I eth1

后续步骤Next steps

尝试创建具有多个 NIC 的 VM 时,请查看 Lnux VM 大小Review Linux VM sizes when trying to creating a VM with multiple NICs. 注意每个 VM 大小支持的 NIC 数目上限。Pay attention to the maximum number of NICs each VM size supports.

若要进一步保护 VM,请使用适时 VM 访问。To further secure your VMs, use just in time VM access. 此功能会视需要打开针对 SSH 流量的网络安全组规则,并根据定义的时间段保持打开。This feature opens network security group rules for SSH traffic when needed, and for a defined period of time. 有关详细信息,请参阅使用恰时功能管理虚拟机访问For more information, see Manage virtual machine access using just in time.